fix(sdl): add expirationDate to guardian baseline result entries

#124 added the missing `createdDate` and cleared that error, but left
`expirationDate` off on purpose. The SDL policy rejects the entries for
exactly that:

    ##[error]Result with signature <76fd7a25...> on file
    <guardian_baselines.gdnbaselines> is not compliant with the provided
    policy. Reason: undefined. -- Additional arguments:You must provide a
    valid expiration date for @microsoft/sdl/no-inner-html

`Baselined results: 0` and Guardian still exits 8, so the next publish
run on main failed the same way.

Both fields are required for this rule, not just `createdDate`. The
reasoning in #124 for omitting the expiry -- that a vendored bundle
should not need renewing -- is not available under this policy. Other
repositories under the same policy all carry an expiry, with windows of
90, 180 and 200 days.

Use 90 days, the shortest and most conservative of those.

This does mean the baseline lapses on 2026-11-27. Say so in the
justification so whoever hits it next has the context, and prefer an
ESLint path exclusion for `crates/cargo-gamma-lib/src/vendor/` as the
durable fix.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Vaiz

guardian_baselines.gdnbaselines

@@ -26,7 +26,8 @@
       "tool": "eslint",
       "ruleId": "@microsoft/sdl/no-inner-html",
       "createdDate": "2026-08-29 01:01:08Z",
-      "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring."
+      "expirationDate": "2026-11-27 00:00:00Z",
+      "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring. The M365 policy requires an expiration date for @microsoft/sdl/no-inner-html, so this baseline lapses on 2026-11-27 and must be renewed or replaced by an ESLint path exclusion before then."
     },
     "6c2296c115b4b8e065b919eac81644836d8995df35d788303693fc78d10b940d": {
       "signature": "6c2296c115b4b8e065b919eac81644836d8995df35d788303693fc78d10b940d",
@@ -43,7 +44,8 @@
       "tool": "eslint",
       "ruleId": "@microsoft/sdl/no-inner-html",
       "createdDate": "2026-08-29 01:01:08Z",
-      "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring."
+      "expirationDate": "2026-11-27 00:00:00Z",
+      "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring. The M365 policy requires an expiration date for @microsoft/sdl/no-inner-html, so this baseline lapses on 2026-11-27 and must be renewed or replaced by an ESLint path exclusion before then."
     },
     "c4f9dd267f73ed656e10bef2a86d91248af954f913c1c22b01fb09c9a52af6c8": {
       "signature": "c4f9dd267f73ed656e10bef2a86d91248af954f913c1c22b01fb09c9a52af6c8",
@@ -60,7 +62,8 @@
       "tool": "eslint",
       "ruleId": "@microsoft/sdl/no-inner-html",
       "createdDate": "2026-08-29 01:01:08Z",
-      "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring."
+      "expirationDate": "2026-11-27 00:00:00Z",
+      "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring. The M365 policy requires an expiration date for @microsoft/sdl/no-inner-html, so this baseline lapses on 2026-11-27 and must be renewed or replaced by an ESLint path exclusion before then."
     }
   }
 }